2021 CVEs (page 2)
Page 2 of 235 — CVEs published in 2021, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-47913 | Medium | 6.4 | 2026-02-01 | PHP Melody 3.0 contains a persistent cross-site scripting vulnerability in the video editor that allows privileged users to inject malicious scripts. Attackers… |
CVE-2021-47912 | Medium | 6.4 | 2026-02-01 | PHP Melody version 3.0 contains multiple non-persistent cross-site scripting vulnerabilities in categories, import, and user import files. Attackers can inject… |
CVE-2021-47911 | Medium | 5.4 | 2026-02-01 | Affiliate Pro 1.7 contains multiple reflected cross-site scripting vulnerabilities in the index module's input fields. Attackers can inject malicious scripts t… |
CVE-2021-47909 | High | 8.1 | 2026-02-01 | Mult-E-Cart Ultimate 2.4 contains multiple SQL injection vulnerabilities in inventory, customer, vendor, and order modules. Remote attackers with privileged ve… |
CVE-2021-47908 | Medium | 6.4 | 2026-02-01 | Ultimate POS 4.4 contains a persistent cross-site scripting vulnerability in the product name parameter that allows remote attackers to inject malicious script… |
CVE-2021-47885 | Medium | 6.4 | 2026-02-01 | Multiple payment terminal versions contain non-persistent cross-site scripting vulnerabilities in billing and payment information input fields. Attackers can i… |
CVE-2021-47856 | Medium | 6.4 | 2026-02-01 | Easy Cart Shopping Cart 2021 contains a non-persistent cross-site scripting vulnerability in the search module's keyword parameter. Remote attackers can inject… |
CVE-2021-47902 | High | 8.2 | 2026-01-27 | Testa Online Test Management System 3.4.7 contains a SQL injection vulnerability that allows attackers to manipulate database queries through the 'q' search pa… |
CVE-2021-47901 | Critical | 9.8 | 2026-01-27 | Dirsearch 0.4.1 contains a CSV injection vulnerability when using the --csv-report flag that allows attackers to inject formulas through redirected endpoints… |
CVE-2021-47900 | Critical | 9.8 | 2026-01-27 | Gila CMS versions prior to 2.0.0 contain a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands throu… |
CVE-2021-47906 | Medium | 6.4 | 2026-01-23 | BloofoxCMS 0.5.2.1 contains a stored cross-site scripting vulnerability in the articles text parameter that allows authenticated attackers to inject malicious… |
CVE-2021-47905 | Medium | 6.1 | 2026-01-23 | MyBB Delete Account Plugin 1.4 contains a cross-site scripting vulnerability in the account deletion reason input field. Attackers can inject malicious scripts… |
CVE-2021-47904 | High | 8.8 | 2026-01-23 | PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execution. Attackers can upload a malicious P… |
CVE-2021-47903 | High | 8.8 | 2026-01-23 | LiteSpeed Web Server Enterprise 5.4.11 contains an authenticated command injection vulnerability in the external app configuration interface. Authenticated adm… |
CVE-2021-47899 | Medium | 4.0 | 2026-01-23 | YetiShare File Hosting Script 5.1.0 contains a server-side request forgery vulnerability that allows attackers to read local system files through the remote fi… |
CVE-2021-47898 | High | 7.8 | 2026-01-23 | Epson USB Display 1.6.0.0 contains an unquoted service path vulnerability in the EMP_UDSA service running with LocalSystem privileges. Attackers can exploit th… |
CVE-2021-47897 | High | 7.2 | 2026-01-23 | PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the address parameter of the change_params.php script. Attackers can inject malicio… |
CVE-2021-47896 | High | 7.8 | 2026-01-23 | PDF Complete Corporate Edition 4.1.45 contains an unquoted service path vulnerability in the pdfcDispatcher service that allows local attackers to potentially… |
CVE-2021-47895 | High | 7.5 | 2026-01-23 | Nsauditor 3.2.2.0 contains a denial of service vulnerability that allows attackers to crash the application by overwriting the Event Description field with a l… |
CVE-2021-47894 | High | 7.5 | 2026-01-23 | Managed Switch Port Mapping Tool 2.85.2 contains a denial of service vulnerability that allows attackers to crash the application by creating an oversized buff… |
CVE-2021-47893 | High | 7.5 | 2026-01-23 | AgataSoft PingMaster Pro 2.1 contains a denial of service vulnerability in the Trace Route feature that allows attackers to crash the application by overflowin… |
CVE-2021-47892 | High | 7.2 | 2026-01-23 | PEEL Shopping 9.3.0 contains a stored cross-site scripting vulnerability in the 'Comments / Special Instructions' parameter of the purchase page. Attackers can… |
CVE-2021-47891 | Critical | 9.8 | 2026-01-23 | Unified Remote 3.9.0.2463 contains a remote code execution vulnerability that allows attackers to send crafted network packets to execute arbitrary commands. A… |
CVE-2021-47890 | High | 7.8 | 2026-01-23 | LogonExpert 8.1 contains an unquoted service path vulnerability in the LogonExpertSvc service running with LocalSystem privileges. Attackers can exploit the un… |
CVE-2021-47889 | High | 7.8 | 2026-01-23 | Softros LAN Messenger 9.6.4 contains an unquoted service path vulnerability in the SoftrosSpellChecker service that allows local attackers to potentially execu… |
CVE-2021-47888 | High | 8.8 | 2026-01-23 | Textpattern versions prior to 4.8.3 contain an authenticated remote code execution vulnerability that allows logged-in users to upload malicious PHP files. Att… |
CVE-2021-47881 | High | 8.4 | 2026-01-23 | dataSIMS Avionics ARINC 664-1 version 4.5.3 contains a local buffer overflow vulnerability that allows attackers to overwrite memory by manipulating the milstd… |
CVE-2021-47887 | High | 7.8 | 2026-01-21 | OKI Print Job Accounting 4.4.10 contains an unquoted service path vulnerability in the OkiJaSvc service that allows local attackers to potentially execute arbi… |
CVE-2021-47886 | High | 7.8 | 2026-01-21 | Pingzapper 2.3.1 contains an unquoted service path vulnerability in the PingzapperSvc service that allows local attackers to potentially execute arbitrary code… |
CVE-2021-47884 | High | 7.8 | 2026-01-21 | OKI Configuration Tool 1.6.53 contains an unquoted service path vulnerability in the OKI Local Port Manager service that allows local attackers to potentially… |
CVE-2021-47883 | High | 7.8 | 2026-01-21 | Sandboxie Plus 0.7.2 contains an unquoted service path vulnerability in the SbieSvc service that allows local attackers to execute code with elevated privilege… |
CVE-2021-47882 | High | 7.8 | 2026-01-21 | FreeLAN 2.2 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to execute arbitrary code. Attacke… |
CVE-2021-47880 | High | 7.8 | 2026-01-21 | Realtek Wireless LAN Utility 700.1631 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system… |
CVE-2021-47879 | High | 7.8 | 2026-01-21 | eBeam Interactive Suite 3.6 contains an unquoted service path vulnerability in the eBeam Stylus Driver service that allows local users to potentially execute c… |
CVE-2021-47878 | High | 7.8 | 2026-01-21 | eBeam Education Suite 2.5.0.9 contains an unquoted service path vulnerability in the eBeam Device Service that allows local users to potentially execute code w… |
CVE-2021-47877 | High | 7.5 | 2026-01-21 | GeoGebra Graphing Calculator 6.0.631.0 contains a denial of service vulnerability that allows attackers to crash the application by inputting an oversized buff… |
CVE-2021-47876 | High | 7.5 | 2026-01-21 | GeoGebra Classic 5.0.631.0-d contains a denial of service vulnerability in the input field that allows attackers to crash the application by sending oversized… |
CVE-2021-47875 | Critical | 9.8 | 2026-01-21 | GeoGebra CAS Calculator 6.0.631.0 contains a denial of service vulnerability that allows attackers to crash the application by generating a large buffer overfl… |
CVE-2021-47874 | High | 7.8 | 2026-01-21 | VFS for Git 1.0.21014.1 contains an unquoted service path vulnerability in the GVFS.Service Windows service that allows local attackers to execute code with el… |
CVE-2021-47873 | High | 7.2 | 2026-01-21 | VestaCP versions prior to 0.9.8-25 contain a cross-site scripting vulnerability in the IP interface configuration that allows attackers to inject malicious scr… |
CVE-2021-47872 | High | 7.1 | 2026-01-21 | SEO Panel versions prior to 4.9.0 contain a blind SQL injection vulnerability in the archive.php page that allows authenticated attackers to manipulate databas… |
CVE-2021-47871 | High | 8.8 | 2026-01-21 | Hestia Control Panel 1.3.2 contains an arbitrary file write vulnerability that allows authenticated attackers to write files to arbitrary locations using the A… |
CVE-2021-47870 | Medium | 5.4 | 2026-01-21 | GetSimple CMS My SMTP Contact Plugin 1.1.2 suffers from a Stored Cross-Site Scripting (XSS) vulnerability. The plugin attempts to sanitize user input using htm… |
CVE-2021-47869 | High | 7.8 | 2026-01-21 | Brother BRAdmin Professional 3.75 contains an unquoted service path vulnerability in the BRA_Scheduler service that allows local users to potentially execute a… |
CVE-2021-47868 | High | 7.8 | 2026-01-21 | WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the WPCommandFileService that allows local users to potentially execute code with elevated… |
CVE-2021-47867 | High | 7.8 | 2026-01-21 | WIN-PACK PRO4.8 contains an unquoted service path vulnerability in the ScheduleService that allows local users to potentially execute code with elevated system… |
CVE-2021-47866 | High | 7.8 | 2026-01-21 | WIN-PACK PRO 4.8 contains an unquoted service path vulnerability in the GuardTourService that allows local users to potentially execute code with elevated syst… |
CVE-2021-47865 | High | 7.5 | 2026-01-21 | ProFTPD 1.3.7a contains a denial of service vulnerability that allows attackers to overwhelm the server by creating multiple simultaneous FTP connections. Atta… |
CVE-2021-47864 | High | 7.8 | 2026-01-21 | OSAS Traverse Extension 11 contains an unquoted service path vulnerability in the TravExtensionHostSvc service running with LocalSystem privileges. Attackers c… |
CVE-2021-47863 | High | 7.8 | 2026-01-21 | MacPaw Encrypto 1.0.1 contains an unquoted service path vulnerability in its Encrypto Service configuration that allows local attackers to potentially execute… |
CVE-2021-47862 | High | 7.8 | 2026-01-21 | Hi-Rez Studios 5.1.6.3 contains an unquoted service path vulnerability in the HiPatchService that allows local attackers to execute code with elevated privileg… |
CVE-2021-47861 | High | 7.8 | 2026-01-21 | Event Log Explorer 4.9.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system pri… |
CVE-2021-47860 | Medium | 5.3 | 2026-01-21 | GetSimple CMS Custom JS 0.1 plugin contains a cross-site request forgery vulnerability that allows unauthenticated attackers to inject arbitrary client-side co… |
CVE-2021-47859 | High | 7.8 | 2026-01-21 | ActivIdentity 8.2 contains an unquoted service path vulnerability in the ac.sharedstore service that allows local attackers to potentially execute arbitrary co… |
CVE-2021-47858 | High | 7.2 | 2026-01-21 | Genexis Platinum-4410 P4410-V2-1.31A contains a stored cross-site scripting vulnerability in the 'start_addr' parameter of the Security Management interface. A… |
CVE-2021-47857 | High | 7.2 | 2026-01-21 | Moodle 3.10.3 contains a persistent cross-site scripting vulnerability in the calendar event subtitle field that allows attackers to inject malicious scripts… |
CVE-2021-47855 | High | 7.2 | 2026-01-21 | Openlitespeed 1.7.9 contains a stored cross-site scripting vulnerability in the dashboard's Notes parameter that allows administrators to inject malicious scri… |
CVE-2021-47854 | Critical | 9.8 | 2026-01-21 | DD-WRT version 45723 contains a buffer overflow vulnerability in the UPNP network discovery service that allows remote attackers to potentially execute arbitra… |
CVE-2021-47852 | High | 8.8 | 2026-01-21 | Rockstar Games Launcher 1.0.37.349 contains a privilege escalation vulnerability that allows authenticated users to modify the service executable with weak per… |
CVE-2021-47851 | Critical | 9.8 | 2026-01-21 | Mini Mouse 9.2.0 contains a remote code execution vulnerability that allows attackers to execute arbitrary commands through an unauthenticated HTTP endpoint. A… |
CVE-2021-47850 | High | 7.5 | 2026-01-21 | Mini Mouse 9.2.0 contains a path traversal vulnerability that allows remote attackers to access arbitrary system files and directories through crafted HTTP req… |
CVE-2021-47849 | Medium | 6.2 | 2026-01-21 | Mini Mouse 9.3.0 contains a path traversal vulnerability that allows attackers to access sensitive system directories through the device information endpoint… |
CVE-2021-47848 | High | 8.2 | 2026-01-21 | Blitar Tourism 1.0 contains an authentication bypass vulnerability that allows attackers to bypass login by injecting SQL code through the username parameter… |
CVE-2021-47846 | High | 8.2 | 2026-01-21 | Digital Crime Report Management System 1.0 contains a critical SQL injection vulnerability affecting multiple login pages that allows unauthenticated attackers… |
CVE-2021-47830 | Medium | 6.5 | 2026-01-21 | GetSimple CMS My SMTP Contact Plugin 1.1.1 contains a cross-site request forgery (CSRF) vulnerability. Attackers can craft a malicious webpage that, when visit… |
CVE-2021-47817 | Medium | 5.4 | 2026-01-21 | OpenEMR 5.0.2.1 contains a cross-site scripting vulnerability in user profile parameters that authenticated attackers can chain with a file upload to achieve r… |
CVE-2021-47802 | High | 7.5 | 2026-01-21 | Tenda D151 and D301 routers contain an unauthenticated configuration download vulnerability that allows remote attackers to retrieve router configuration files… |
CVE-2021-47778 | High | 7.2 | 2026-01-21 | GetSimple CMS My SMTP Contact Plugin 1.1.2 contains a PHP code injection vulnerability. An authenticated administrator can inject arbitrary PHP code through pl… |
CVE-2021-47770 | High | 8.8 | 2026-01-21 | OpenPLC v3 contains an authenticated remote code execution vulnerability that allows attackers with valid credentials to inject malicious code through the hard… |
CVE-2021-47748 | Critical | 9.8 | 2026-01-21 | Hasura GraphQL 1.3.3 contains a remote code execution vulnerability that allows attackers to execute arbitrary shell commands through SQL query manipulation. A… |
CVE-2021-47746 | High | 7.5 | 2026-01-21 | NodeBB Plugin Emoji 3.2.1 contains an arbitrary file write vulnerability that allows administrative users to write files to arbitrary system locations through… |
CVE-2021-47847 | High | 7.8 | 2026-01-16 | Disk Sorter Server 13.6.12 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to potentially execute… |
CVE-2021-47845 | High | 7.8 | 2026-01-16 | Spy Emergency 25.0.650 contains an unquoted service path vulnerability in its Windows service configurations that allows local attackers to execute code with e… |
CVE-2021-47844 | Medium | 6.1 | 2026-01-16 | Xmind 2020 contains a cross-site scripting vulnerability that allows attackers to inject malicious payloads into mind mapping files or custom headers. Attacker… |
CVE-2021-47842 | High | 7.2 | 2026-01-16 | StudyMD 0.3.2 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into markdown files. Attackers can upl… |
CVE-2021-47841 | Medium | 6.1 | 2026-01-16 | SnipCommand 0.1.0 contains a cross-site scripting vulnerability that allows attackers to inject malicious payloads into command snippets. Attackers can execute… |
CVE-2021-47840 | High | 7.2 | 2026-01-16 | Moeditor 0.2.0 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads within markdown files. Attackers can… |
CVE-2021-47839 | High | 7.2 | 2026-01-16 | Marky 0.0.1 contains a persistent cross-site scripting vulnerability that allows attackers to inject malicious scripts into markdown files. Attackers can uploa… |
CVE-2021-47838 | High | 7.2 | 2026-01-16 | Markright 1.0 contains a persistent cross-site scripting vulnerability that allows attackers to embed malicious payloads in markdown files. Attackers can uploa… |
CVE-2021-47837 | High | 7.2 | 2026-01-16 | Markdownify 1.2.0 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads within markdown files. Attackers c… |
CVE-2021-47836 | Medium | 6.1 | 2026-01-16 | Markdown Explorer 0.1.1 contains a cross-site scripting vulnerability that allows attackers to inject malicious code through file uploads and editor inputs. At… |
CVE-2021-47835 | High | 7.2 | 2026-01-16 | Freeter 1.2.1 contains a persistent cross-site scripting vulnerability that allows attackers to store malicious payloads in custom widget titles and files. Att… |
CVE-2021-47834 | Medium | 6.4 | 2026-01-16 | Schlix CMS 2.2.6-6 contains a persistent cross-site scripting vulnerability that allows authenticated users to inject malicious scripts into category titles. A… |
CVE-2021-47833 | High | 7.8 | 2026-01-16 | WifiHotSpot 1.0.0.0 contains an unquoted service path vulnerability in its WifiHotSpotService.exe that allows local attackers to execute code with elevated pri… |
CVE-2021-47831 | High | 7.5 | 2026-01-16 | Sandboxie 5.49.7 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the container folder input field. Att… |
CVE-2021-47829 | High | 7.8 | 2026-01-16 | DHCP Broadband 4.1.0.1503 contains an unquoted service path vulnerability in its service configuration that allows local attackers to execute code with elevate… |
CVE-2021-47828 | High | 7.8 | 2026-01-16 | BOOTP Turbo 2.0.0.1253 contains an unquoted service path vulnerability in its Windows service configuration. Attackers can exploit the unquoted path to execute… |
CVE-2021-47827 | High | 7.5 | 2026-01-16 | WebSSH for iOS 14.16.10 contains a denial of service vulnerability in the mashREPL tool that allows attackers to crash the application by pasting malformed inp… |
CVE-2021-47826 | High | 7.8 | 2026-01-16 | Acer Backup Manager 3.0.0.99 contains an unquoted service path vulnerability in the NTI IScheduleSvc service that allows local users to potentially execute arb… |
CVE-2021-47825 | High | 7.8 | 2026-01-16 | Acer Updater Service 1.2.3500.0 contains an unquoted service path vulnerability that allows local users to execute code with elevated system privileges. Attack… |
CVE-2021-47824 | High | 7.5 | 2026-01-16 | iDailyDiary 4.30 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the preferences tab name field. Attac… |
CVE-2021-47823 | High | 7.8 | 2026-01-16 | Acer ePowerSvc 6.0.3008.0 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges… |
CVE-2021-47822 | High | 7.8 | 2026-01-16 | DiskBoss Service 12.2.18 contains an unquoted service path vulnerability in its binary path configuration that allows local attackers to execute code with elev… |
CVE-2021-47821 | High | 7.5 | 2026-01-16 | RarmaRadio 2.72.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowing network configuration fields with la… |
CVE-2021-47820 | Medium | 5.3 | 2026-01-16 | Ubee EVW327 contains a cross-site request forgery vulnerability that allows attackers to enable remote access without user interaction. Attackers can craft a m… |
CVE-2021-47818 | High | 7.5 | 2026-01-16 | DupTerminator 1.4.5639.37199 contains a denial of service vulnerability that allows attackers to crash the application by inputting a long character string in… |
CVE-2021-47816 | High | 8.8 | 2026-01-16 | Thecus N4800Eco NAS Server Control Panel contains a command injection vulnerability that allows authenticated attackers to execute arbitrary system commands th… |
CVE-2021-47815 | High | 7.5 | 2026-01-16 | Nsauditor 3.2.3 contains a denial of service vulnerability in the registration code input field that allows attackers to crash the application. Attackers can p… |
CVE-2021-47814 | High | 7.5 | 2026-01-16 | NBMonitor 1.6.8 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the registration code input field. Att… |
CVE-2021-47813 | High | 7.5 | 2026-01-16 | Backup Key Recovery 2.2.7 contains a denial of service vulnerability that allows attackers to crash the application by overflowing the registration code input… |